diff --git a/advisories/unreviewed/2025/05/GHSA-35ch-876f-6mw7/GHSA-35ch-876f-6mw7.json b/advisories/unreviewed/2025/05/GHSA-35ch-876f-6mw7/GHSA-35ch-876f-6mw7.json
new file mode 100644
index 00000000000..6030ed50eb7
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-35ch-876f-6mw7/GHSA-35ch-876f-6mw7.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-35ch-876f-6mw7",
+  "modified": "2025-05-14T03:30:31Z",
+  "published": "2025-05-14T03:30:31Z",
+  "aliases": [
+    "CVE-2025-3623"
+  ],
+  "details": "The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automator_api_decode_message() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3623"
+    },
+    {
+      "type": "WEB",
+      "url": "https://automatorplugin.com/knowledge-base/uncanny-automator-changelog/#6-4-0-2-2025-04-18"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php#L540"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3276577/uncanny-automator/trunk/src/core/lib/helpers/class-automator-recipe-helpers.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/uncanny-automator/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/00bcfd8f-9785-449a-a0ea-16e2583d684a?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T03:15:33Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/05/GHSA-m4h7-86xm-549j/GHSA-m4h7-86xm-549j.json b/advisories/unreviewed/2025/05/GHSA-m4h7-86xm-549j/GHSA-m4h7-86xm-549j.json
new file mode 100644
index 00000000000..4956a337d8d
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-m4h7-86xm-549j/GHSA-m4h7-86xm-549j.json
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m4h7-86xm-549j",
+  "modified": "2025-05-14T03:30:31Z",
+  "published": "2025-05-14T03:30:31Z",
+  "aliases": [
+    "CVE-2025-4520"
+  ],
+  "details": "The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 6.4.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4520"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/uncanny-automator/tags/6.4.0.2/src/integrations/keap/helpers/keap-helpers.php#L99"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/db5b5fa1-67b5-4103-93b0-682200199a71?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-14T03:15:33Z"
+  }
+}
\ No newline at end of file